Hackers Use Compromised Credentials To Defraud 3rd Party Sellers on Amazon

Amazon’s robust online retail business is strongly supported with 2 million independent sellers. While Amazon has a very strong security profile, some of their sellers are making their own accounts vulnerable to hackers. And it is costing them tens of thousands of dollars.

Hackers are actively targeting those 3rd party sellers using stolen and compromised credentials (a password and user name combo) to gain access to the seller’s account.

In simple terms, here is what is happening to some of these 3rd party sellers:
• The seller uses one password to manage multiple online accounts on different websites.
• The seller’s password is exposed through a data breach or leak on one of those websites.
• The seller’s password is circulated on the Internet and is now compromised.
• Hackers test that password across multiple websites (credential stuffing) to gain access to one of the accounts for that user.

In this case, they were able to access the seller’s Amazon account. Once they gain access to the seller’s Amazon account, the hackers are re-routing banks deposits and selling false merchandise without any delivery. For example, a company called Lightning X Products had $60,000 disappear from its Amazon account last month. While Amazon is trying to detect fraudulent activity and take care of their sellers, it is timely and costly to rectify it.

All of this because there was a data leak and the seller is re-using their password. The result is that the seller is using a compromised password.

According to Alex Stamos, CSO Facebook, the reuse of passwords is the No. 1 cause of harm on the Internet, which is why so many companies are investing in technology to detect and block use of compromised credentials. PasswordPing now provides an affordable way to solve this problem using the same approach applied by Facebook and other leading technology companies, but for a fraction of the cost.

If you are interested in learning more about how to block use of compromised credentials, please visit www.passwordping.com.

Why is this secure?

This page, and indeed our entire business, exists to help make passwords more secure, not less. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater.

Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. Thus, it is necessary for us to submit a hashed version of your password to our server. To protect this data from eavesdropping, it is submitted over an SSL connection. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. Many of the passwords we find on the web are not plaintext; they are unsalted hashes of the passwords. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. We do not store any of the submitted data. It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. Our server-side infrastructure is hardened against infiltration using industry standard tools and techniques and is routinely tested and reviewed for soundness.

More Information

This site is for EDUCATIONAL PURPOSES ONLY. Your password will be sent securely to the PasswordPing servers to check if it is compromised. We do not store your password or use it for any other purpose. If you are not comfortable with this, do not enter your real password.

What is this?

Password Check is a free tool that lets you determine not just the strength of a password (how complex it is), but also whether it is known to be compromised. Billions of user passwords have been exposed by hackers on the web and dark web over the years and as a result they are no longer safe to use. So even if your password is very long and complex, and thus very strong, it may still be a bad choice if it appears on this list of compromised passwords. This is what the Password Check tool was designed to tell you and why it is superior to traditional password strength estimators you may find elsewhere on the web.

Why is it needed?

If you are using one of these compromised passwords, it puts you at additional risk, especially if you are using the same password on every site you visit. Cybercriminals rely on the fact that most people reuse the same login credentials on multiple sites.

Why is this secure?

This page, and indeed our entire business, exists to help make passwords more secure, not less. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater. Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. Thus, it is necessary for us to submit a hashed version of your password to our server. To protect this data from eavesdropping, it is submitted over an SSL connection. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. Many of the passwords we find on the web are not plaintext; they are unsalted hashes of the passwords. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. We do not store any of the submitted data. It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. Our server-side infrastructure is hardened against infiltration using industry standard tools and techniques and is routinely tested and reviewed for soundness.